Zero-Trust Workload Identity: Architect and implement identity frameworks (e.g., SPIFFE/SPIRE, mTLS, Service Mesh) to establish cryptographically verified identity for microservices operating across cloud, ground segment nodes, and hybrid edge hardware.
SDN & Control Plane Hardening: Conduct threat modeling and design runtime security controls for our Software-Defined Networking (SDN) stack, protecting routing protocols, control messages, and telemetry streams from spoofing, tampering, and denial-of-service (DoS) attacks.
Runtime Defense & Policy Enforcement: Deploy eBPF-based runtime monitoring (e.g., Tetragon, Falco, Cilium) and policy-as-code admission controllers (OPA/Gatekeeper) to detect and neutralize zero-day exploits, container breakouts, and unauthorized process executions in real time.
Key Ceremonies & PKI Governance: Design, orchestrate, and execute formal cryptographic key ceremonies (multi-party key generation, root CA creation, and secret splitting) to establish trust anchors for root certificate authorities, satellite communication keys, and cloud/ground HSM clusters
Hardware-Backed Key & Cryptographic Management: Oversee the architecture for root-of-trust, Hardware Security Modules (HSMs), TPMs, and Vault clusters managing satellite communications keys, TLS certificates, and secrets lifecycle.
Security Telemetry & Anomaly Detection: Collaborate with the Platform team to embed security observability into high-throughput logging and telemetry pipelines (Kafka, Prometheus, SIEM/SOAR) for automated threat detection and incident response.
Defense & Federal Compliance: Translate rigorous federal and defense cybersecurity mandates (e.g., NIST SP 800-53, CMMC Level 3+, FedRAMP High, DoD IL5/IL6) into technical security designs without compromising platform agility or speed.
